Privacy notice

Liam Glynn, operating ShipReady and Workroom, is responsible for the personal information described here. Privacy questions and rights requests can be sent to liamglynnlg@gmail.com.

• Enquiry details you choose to provide, such as your name, email, product URL, stack, launch timing, critical journey and known blocker.
• Contract, billing, intake, access, project, delivery and support records where you engage ShipReady.
• Limited website and conversion information, including page, campaign attribution, referrer category and viewport category. Custom analytics events are designed not to include names, email addresses, supplied product or repository URLs, tokens or message content.
• Technical, security and audit records needed to operate the service and investigate failures.

Information is used to assess an enquiry, prepare or perform an agreed service, communicate about delivery, process and reconcile payments, protect the service, meet legal or accounting duties, and understand whether public material helps founders reach the correct offer.

Depending on the activity, the basis is taking steps at your request or performing a contract, compliance with a legal duty, consent where required, or the legitimate interests of operating a secure service and responding to relevant business enquiries.

Workroom can connect only Liam Glynn’s authorised Gmail account. It uses Gmail access for owner-controlled messages, labels, matching known conversation threads and detecting replies so that future follow-ups can be stopped. It does not provide public users with Gmail access and does not use Google Workspace data for advertising, profiling or sale.

OAuth refresh tokens are stored as encrypted secrets in Supabase Vault and are not returned to the browser. Workroom reads only operationally relevant, known conversation threads rather than scanning the mailbox for unrelated content. Use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Service providers may process information only to supply their contracted function. Current categories include hosting and analytics (Vercel), database, authentication and secure secret storage (Supabase), transactional email (Resend), payments when activated for an agreed engagement (Stripe), operator email (Google) and operational alerts (Slack). Client-owned source and infrastructure remain client-owned.

Some providers may process information outside your country. The applicable provider contracts and lawful transfer mechanisms are used where required. Ask by email if you need details relevant to a particular engagement.

Information is kept only for the period needed for the enquiry, delivery, security, audit, dispute, accounting or legal purpose for which it was collected. Unsuccessful enquiry records and full message content are minimised when no longer operationally useful. Financial and contractual records are retained for the applicable statutory period. Suppression records may be kept longer so an opt-out remains honoured. Client access is reviewed after delivery.

Workroom uses access controls, tenant isolation, server-only privileged credentials, audit records and fail-closed automation. No online service can promise absolute security; suspected issues should be reported promptly to the contact above.

Depending on the law that applies, you may ask for access, correction, deletion, restriction or portability, withdraw consent, or object to processing based on legitimate interests. The right to object to direct marketing can be exercised at any time; an opt-out is applied immediately to future outreach.

UK residents may also complain to the Information Commissioner’s Office. Contact Liam first where practical so the issue can be addressed.

This notice will be updated when the operating entity, data uses, providers or retention model materially change. The current date will remain visible at the top of this page.

See also the service terms.